Secret quantum communication of a reference frame 
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We propose quantum cryptographic protocols to secretly communicate a reference frame — 
unspeakable information in the sense it cannot be encoded into a string of bits. Two distant parties 
can secretly align their Cartesian axes by exchanging TV spin 1/2 particles, achieving the optimal 
accuracy 1/N. A possible eavesdropper cannot gain any information without being detected. 
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Any communication about the properties of a physi- 
cal object requires not only the transmission of a string 
of bits, but also the existence of notions shared between 
sender and receiver. For example, to communicate the 
length of an object, they must agree on a unit of length. 
In many cases, the natural units of length, time, and 
mass (jjj provide a common standard that allows any two 
parties to communicate by simply exchanging bits, even 
though they have never met. However, such standard ref- 
erences do not exist for all properties, as some cannot be 
communicated as strings of bits [Q, 0| and are hence re- 
ferred to as unspeakable information^, |5|. For example, 
due to the fundamental isotropy of space, a string of bits 
can encode only the relative orientation of two directions, 
but not the absolute orientation of a single direction in 
space. In such cases, the only possibility for the sender 
to establish a shared notion with the receiver is to send 
a physical object — such as a gyroscope — that provides 
the common standard. This situation arises whenever 
sender and receiver try to establish a shared reference 
frame (SRF), e.g. by aligning their Cartesian axes, or by 
synchronizing their clocks. 

Using quantum cryptography, one can securely send 
speakable information (i.e. strings of bits) through a pub- 
lic channel. One might then ask whether the same is true 
for unspeakable information. The answer is not trivial 
since to convey unspeakable info a physical carrier must 
be sent, and it can be intercepted by an eavesdropper. In 
this paper we present quantum cryptographic protocols 
to encode spatial directions and reference frames so that 
no eavesdropper can obtain information on them. This is 
useful also for quantum cryptography, since private SRFs 
are an important resource to realize both classical and 
quantum secret communication ||. Here, we consider 
communication through the transmission of N spin 1/2 
particles. We start by showing a simple, experimentally 
feasible protocol that uses N shared secret bits and N 
separable states to communicate a secret direction with 
accuracy 1/yN. Then, we present the optimal proto- 
col, which exploits entanglement and secretly transmits a 
whole Cartesian frame. Such a protocol employs 31ogJV 
secret bits to achieve accuracy 1/N. Remarkably, this 
amount of secret bits exactly coincides with the number 



of secret bits that can be exchanged once a private SRF 
is established ||. Such a tight balance provides a new 
understanding of reference frames as a communication 
resource. Note that the above protocols do not need the 
two parties to possess the shared secret bits beforehand: 
They can obtain them using quantum key distribution, 
which does not necessarily require a prior shared refer- 
ence [0, ||. This suggests that protocols that do not 
use prior classical randomness can be implemented. We 
conclude the paper by providing two such protocols that 
require only quantum and classical communication over 
a public channel. 

Separable protocol using secret random bits. — The in- 
tuitive idea of this protocol is that two parties (say Alice 
and Bob) can transform a secret shared random string 
into a secret shared direction. Imagine that Alice wants 
to communicate to Bob the secret direction of her z-axis. 
For each and 1 in the secret string, she sends a spin 
1/2 particle pointing respectively up and down (accord- 
ing to her own z axis). Then, Bob just needs to rotate 
the z axis of his Stern-Gerlach apparatus until its mea- 
surement results (0 for "up" and 1 for "down") match 
the bits of the shared secret string. When this happens, 
he knows that he has aligned his z axis with Alice's. A 
possible eavesdropper Eve will not be able to gain any 
information on the direction of the z axis, since she does 
not know the secret string. In fact, from her point of 
view a random sequence of spin up/spin down is equiva- 
lent to the maximally chaotic state, where the spins are 
randomly oriented in any direction she might choose to 
sample. Moreover, if Eve is tampering with the commu- 
nication, Bob will find it out as any direction he chooses 
for his Stern-Gerlach apparatus will never yield the secret 
string as outcome bits. 

A more practical implementation of the above proto- 
col can be obtained if Bob performs all measurements 
aligning his Stern-Gerlach apparatus alternately along 
his own x, y and z axes. The probability that Alice's 
spin up states (identified by zeros in the shared secret 
key) will have outcome "up" in Bob's z-oriented Stern- 
Gerlach apparatus is p(9) = cos 2 9/2, where 9 is the un- 
known angle between Alice and Bob's z axes. This is also 
the probability that Alice's spin down states (identified 
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by ones) will have outcome "down" at Bob's apparatus. 
Therefore, Bob can estimate such probability from his 
outcomes on N spins aspg = [AT (up, 0) + 7V(down, 1)]/N, 
where N(i,j) is the number of spins that gave outcome 
i when the corresponding shared secret bit was j. Once 
the angle 9 has been estimated from pg, Bob orients his 
Stern-Gerlach apparatus along his x and y axes, and re- 
peats the procedure to recover the angles between these 
and Alice's z axis. The eavesdropper Eve can be de- 
tected by Bob. In fact, her action would result in a de- 
polarization of the transmitted spins and the three angles 
Bob recovers would be inconsistent. He can discover it 
if the sum of their squared cosines differs from one by 
more than a purely statistical error would allow. The 
accuracy of Bob's procedure can be evaluated as follows. 
The rms error in the estimate of p(9) from the data is 
Ap(0) = y/pe-Pe/VN. Then, from error propagation 
theory, the error on each of the angles 9 estimated from 
pe is 
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since pg ~ > p(9) for large N . Thus, Bob's overall error on 
his estimate of the direction of Alice's z axis using 3A?" 
spins will be 3/y/N. Notice that, without using entangled 
states at the preparation stage, the X/VN asymptotic 
scaling cannot be beaten ||. 

To send a spatial direction, the exchanged qubits must 
possess directional information, as is the case of spin 1/2 
particles. Nevertheless, a partial directional information 
can be encoded also in the polarization of a photon. In 
fact, using single photons one can transmit a direction 
in the plane orthogonal to the wave vector. In this case 
Bob just needs to orient his polarizers in two directions 
(say the x and y axes), and the above procedure gives 
him Alice's secret direction with accuracy 2^/2/N. 

Optimal protocol using secret random bits. — The pre- 
vious protocol requires A" qubits and N secret bits to 
communicate a secret spatial direction with an rms er- 
ror 3y/3/N. Now we show that a suitable use of entan- 
glement allows to transmit a whole frame of Cartesian 
axes with rms error X/N, with only 31ogAf secret bits 
needed. To this purpose, we first recall the basic features 
of the optimal protocol to publicly transmit a Cartesian 
frame then showing how to modify it in order to 
achieve unconditional security. 

The optimal state for the reference frame communica- 
tion requires the decomposition of the Hilbcrt space Ti® N 
of A" spin 1/2 particles into irreducible representations of 
the rotation group. This decomposition is given by 
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where j is the quantum number of the total angular mo- 
mentum, ranging from O(^) to AT/2 for A?" even (odd), 7ij 



is a 2j + 1 dimensional space supporting an irrep of the 
rotation group, and C mj is a multiplicity space, whose 
dimension rrij is equal to the number of equivalent irreps 
corresponding to the quantum number j. In this decom- 
position of the Hilbert space, the action of a collective 
rotation Uf N , g € SU(2) becomes 
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where {U£} is the irreducible representation with angu- 
lar momentum j, and 1^ denotes the identity in a d- 
dimensional Hilbert space. From Eq. (|J) it is clear that 
the multiplicity spaces are the rotationally invariant sub- 
systems of the global Hilbert space TC® N . 

For large N, the optimal states for the transmission of 
a reference frame are given by 0] 
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Aj being suitable coefficients (Aj w tJA/N sin (-S 2 -) for 
N > 1), and \Ej) € Hj <g) C m i being the maximally 
entangled vector 



\Ej) = 
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where {\jm) £ Hj} are the eigenstates of the total an- 
gular momentum J z , and the vector \m) runs on the 
first 2j + X elements of a basis of the multiplicity space 
C mj . Since the state |^4) is prepared by Alice referring 
to her Cartesian frame, from Bob's point of view all 
spins are rotated by the unknown rotation g G SU(2) 
that connects his axes with Alice's. Accordingly, Bob 
receives the state Uf N \A), and his aim is to perform 
the best possible measurement to infer g. For a state of 
the form (^) such measurement is given by the POVM 
M(h) dh = U® N \B) {B\UI® N d h, where dhis the invari- 
ant measure over the rotation group, and \B) is 



\B) = ^2jTl \Ej 



(6) 



The use of the state \ A) and of the measurement M(h) al- 
lows to communicate optimally a Cartesian frame with an 
asymptotic rms error 1 /N 0. The optimality proof for 
this protocol is given in Ref. JlCfl . A transmission scheme 
using only the state \A) is not secret, since anybody can 
intercept the spins, perform the optimal measurement, 
and reprepare the state according to the outcome. 

To construct a secret protocol, notice that the vector 
\Ej) in the state \A) can be replaced by any other max- 
imally entangled vector \Wj) = (Wj <8> t mj )\Ej), where 
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Wj is a local unitary on Jij. With the same substitu- 
tion in the POVM (||), the outcome probabilities in the 
orientation measurement are unchanged. Thus the esti- 
mation is still optimal. The idea then is to randomize the 
choice of the maximally entangled vector \Wj) in order 
to make it impossible for Eve to extract any kind of in- 
formation about Alice's axes. To this purpose, consider 
the unitaries Wj_ Pj . qj defined 

i ,« = c ^(^YTj-)\ m ®pj)( m \ > ( 7 ) 

m=— j 

© here denoting addition modulo 2j + 1. These unitaries 
form a representation of the "shift and multiply" group 
Z 2j+1 x Z 2j+1 , which is irreducible on Ttj. A completely 
secure communication can be obtained if Alice sends one 
of the states 

IAW>= ~tA= (Wi^Q^lEj), (8) 
i=0 (i) V2j + 

chosen according to a secret random sequence {pj , qj } 
that she shares only with Bob. The number of possible se- 
quences is C = J2 N -m^ (2j + 1) 2 ^ 0{N 3 ). This means 

3 — "\ 2 > 

that Alice and Bob asymptotically need 3 log TV bits of 
shared randomness. From the point of view of Eve, the 
randomization procedure is equivalent to the preparation 
of the mixed state p E = J2{ Pj , qj } \ A { Pj , qj })( A {p 3 ^}\/ C - 
Due to the irreducibility of the representations {Wj_ Pj >qj } 
this averaged state can be easily calculated, obtaining 

~ — 1 3 

PE= ® ttfflV 121+1 ® £ |m>H - (9) 

Using Eq. (||), it is immediate to see that Eve's state 
Pe is completely invariant under rotations, therefore no 
useful information can be extracted from it about the 
orientation of Alice's axes. On the other hand, since 
Bob knows which pure state |-<4.{p-,g-}) was sent, he can 
perform the optimal orientation measurement. He then 
recovers Alice's axes with the asymptotically optimal rms 
error 1/N. 

This result sheds a new light on the role of private 
shared reference frames (SRF) as a physical resource. In 
fact, we can relate the above protocol with the crypto- 
graphic protocol of Ref . J(| , where a private SRF is used 
to communicate a secret string of bits. While in our case 
we have asymptotically 

N qbits + 3 log N secret bits — > private SRF , (10) 

in the case of Ref. || one has 

N qbits + private SRF — > 3 log N secret bits . (11) 



In other words, the comparison of the two results gives a 
tight balance between the number of secret random bits 
needed to establish a private SRF and the secret classical 
capacity associated to it. 

Is it really necessary to have a string of secret bits 
to establish a private SRF? Remarkably, this is not the 
case. In the following we sketch two alternative protocols, 
modeled on the BB84 O and the Ekert protocols p2| , in 
which the private SRF is established by only using quan- 
tum and classical communication over an authenticated 
public channel: The main idea of both protocols is to 
exploit the fact that the information encoded in the mul- 
tiplicity spaces C m ' of Eq. (§) is frame- independent [Q, 
since according to Eq. ^ the multiplicity spaces are in- 
variant under rotations. Thus, even though Alice and 
Bob do not share a Cartesian frame, they can exchange 
qubits and test whether an eavesdropper is acting in the 
rotationally invariant subsystems of the Hilbert space. If 
the security level is too low, they can decide to abort 
the protocol (before any reference information is trans- 
mitted). This strategy prevents Eve to access the infor- 
mation encoded in the multiplicity spaces, namely her 
POVM must have the form Pi = ® • Pij ® l mj , for some 
suitable > 0, 'Yin Pij = ^-2j+i- Since for states of the 
form (|4|) representation spaces and multiplicity spaces are 
maximally entangled, Eve's measurement gives no infor- 
mation about Alice's axes (again the state seen by Eve 
is the p E of Eq. (|)). 

BB84~type protocol — With probability 1/2 Alice sends 
the state U® N \A), where h is a random rotation, oth- 
erwise she sends a test-state. The possible test states 
are 

T 3,m. = tt^-t ® \m)(m\ and fj, m = 77^7-7 ® \m)(fh\ , 
2j + 1 2j + 1 

(12) 

where and are two bases of C mj related 

by a Fourier transform. An eavesdropper cannot tell 
whether the state U® N \A) or the test states were sent, 
as there is a large overlap between them, i.e. a fidelity 
F = A 2 j /(2j + l) 2 (of order 1/N 3 for j » AT/4). On 
the other hand, Bob performs with probability 1/2 the 
optimal measurement of orientation, otherwise he per- 
forms a test- measurement. For the test-measurement he 
randomly chooses one of the two von Neumann measure- 
ment Vj tm = I2J+1 <8 \m){m\, or Vj. m = I23+1 ® \rh){m\. 
Then, as in the BB84 protocol, using the authenticated 
public classical channel, Alice and Bob declare the "ba- 
sis" they used: Alice announces whether she prepared an 
orientation-state, a test-state of the kind r, or a test state 
of the kind f , and similarly Bob announces whether he 
measured the orientation, the observable V, or the ob- 
servable V. They keep only the cases where Bob's mea- 
surement coincided with Alice's preparation, and discard 
the rest. Alice announces the values of j and m for the 
test states she sent, so that Bob can check whether or 
not the results of his measurements match with her data. 
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In this way, an eavesdropper in the rotationally invariant 
subsystems can be detected, and Bob can decide to abort 
the protocol, if the security level is not sufficiently high. 
Otherwise, Alice publicly communicates the random ro- 
tation h she performed on the optimal state \A). On 
each of the states Alice sent, Bob estimated the rotation 
gh with rms error 1/N, where g is the unknown rotation 
connecting his axes with Alice's ones. Thus, knowing h, 
Bob can immediately infer g and align his axes. Notice 
that here N is the number of spins in each of the states 
that Alice sends. If she sends M states, the total num- 
ber of transmitted spins is MN and Bob's accuracy will 
scale as 4/ vM N (where the square root comes from the 
central limit theorem, and the factor 4 refers to the fact 
that only 1/4 of the states are used in average for the 
orientation measurement). Compared with the previous 
protocol, the scaling in accuracy with the total number 
MN of spins is sub-optimal, but the decrease in accuracy 
is needed because of the elimination of the prior shared 
random bits. 

Ekert-type protocol. — Alice starts with two sets of N 
spin 1/2 particles, half of which she sends to Bob. The 
Hilbert spaces of both sets of spins, H.® N and H. B N , can 
be decomposed as in Eq. (0), and she can prepare the 
entangled state 

N 1 

2 A- 

\®)ab= == -Y, \j m )A\n) A \jm} B \n) B 

j=0(!) VW + L ) m J m,n 

(13) 

where Aj are the same coefficients as in the optimal state 
in Eq. (Q). Note that for any value of the angular mo- 
mentum the state |$)ab exhibits a maximal entangle- 
ment between the multiplicity spaces C A 3 and C B 3 . For 
this reason, an eavesdropper in the rotationally invariant 
subsystems can be detected by Alice and Bob by test- 
ing Bell inequalities, as in the original Ekert protocol: 
to evade detection Eve must not act on the rotationally 
invariant subsystems of Bob. A SRF is established when 
Alice and Bob both perform the optimal orientation- 
measurement, given by Eq. (^). In fact, the probability 
density that they measure the rotations h A and h B is 
p(h A ,h B ) = ($| M(h A )®Uf N *M(.h B )Uf N \$), where g 
is the unknown rotation connecting their axes. A short 
calculation allows to derive the following equality 

p(h A , h B ) = ($| M{h A ) ® Uf N ^M{h B )Uf N \^>) (14) 
= (A\M(h A h B l g)\A) , 

which implies that h A hg g is distributed with the rms 
error 1/N of the optimal orientation measurement, even 
though the outcomes h A and h B are completely random, 
as the local states of Alice and Bob are rotationally in- 
variant. Once Alice has communicated (with the authen- 
ticated public channel) the outcome h A of her measure- 
ment, Bob can use this information to retrieve the un- 



known rotation g with the precision 1/N. Again, since 
Eve cannot touch the rotationally invariant subsystems, 
she can gain no information about Alice's axes. Also 
here, part of the exchanged spins is employed (in the 
Bell inequalities tests) to make up for the absence of the 
prior shared secret bits. 

Conclusions. — In this Letter we have shown that 
quantum mechanics allows one to secretly communicate 
directions in space, either with or without the need of 
prior secret random bits. We have given a simple proto- 
col that needs no entanglement and an entangled proto- 
col that achieves the ultimate bounds in the precision of 
reference frame transmission. The unentangled protocol 
can be easily implemented experimentally using spin 1/2 
particles or single photon polarization states. Two fur- 
ther protocols that do not need secret random bits have 
also been presented. The ideas of this paper have been 
presented for spatial reference frames, however, they can 
be exploited to achieve the secret transmission of any 
possible reference frame, e.g. to obtain a secret clock 
synchronization. 
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